Added more filter tests

elastic · Nov 26, 2019 · 8752924 · 8752924
1 parent f70bff2
commit 8752924
Showing 1 changed file with 98 additions and 0 deletions.
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/get_filter.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/get_filter.test.ts
@@ -7,6 +7,7 @@
 import { getQueryFilter, getFilter } from './get_filter';
 import { savedObjectsClientMock } from 'src/core/server/mocks';
 import { AlertServices } from '../../../../../alerting/server/types';
+import { PartialFilter } from './types';
 
 describe('get_filter', () => {
   let savedObjectsClient = savedObjectsClientMock.create();
@@ -145,6 +146,103 @@ describe('get_filter', () => {
       });
     });
 
+    test('it should work with a simple filter as a kuery without meta information', () => {
+      const esQuery = getQueryFilter(
+        'host.name: windows',
+        'kuery',
+        [
+          {
+            query: {
+              match_phrase: {
+                'host.name': 'siem-windows',
+              },
+            },
+          },
+        ],
+        ['auditbeat-*']
+      );
+      expect(esQuery).toEqual({
+        bool: {
+          must: [],
+          filter: [
+            {
+              bool: {
+                should: [
+                  {
+                    match: {
+                      'host.name': 'windows',
+                    },
+                  },
+                ],
+                minimum_should_match: 1,
+              },
+            },
+            {
+              match_phrase: {
+                'host.name': 'siem-windows',
+              },
+            },
+          ],
+          should: [],
+          must_not: [],
+        },
+      });
+    });
+
+    test('it should work with a simple filter as a kuery without meta information with an exists', () => {
+      const query: PartialFilter = {
+        query: {
+          match_phrase: {
+            'host.name': 'siem-windows',
+          },
+        },
+      } as PartialFilter;
+
+      const exists: PartialFilter = {
+        exists: {
+          field: 'host.hostname',
+        },
+      } as PartialFilter;
+
+      const esQuery = getQueryFilter(
+        'host.name: windows',
+        'kuery',
+        [query, exists],
+        ['auditbeat-*']
+      );
+      expect(esQuery).toEqual({
+        bool: {
+          must: [],
+          filter: [
+            {
+              bool: {
+                should: [
+                  {
+                    match: {
+                      'host.name': 'windows',
+                    },
+                  },
+                ],
+                minimum_should_match: 1,
+              },
+            },
+            {
+              match_phrase: {
+                'host.name': 'siem-windows',
+              },
+            },
+            {
+              exists: {
+                field: 'host.hostname',
+              },
+            },
+          ],
+          should: [],
+          must_not: [],
+        },
+      });
+    });
+
     test('it should work with a simple filter that is disabled as a kuery', () => {
       const esQuery = getQueryFilter(
         'host.name: windows',